2

We have a corporate MPLS network hosted by a large ISP. Each site has it's own dedicated path to the Internet, so there is no single point of Internet access to place a filtering appliance. We've all but decided on deploying a proxy-based solution from Websense, but I would like recommendations from other professionals. Here's the network setup:

8 sites with T1 connections on the MPLS network
6 sites with AT&T DSL doing IPSEC tunnels to the MPLS network
1 Headquarters with 4x bonded T1 connections to the MPLS network
Each site has it's own egress/ingress to the Internet
~100 users between all locations
~25 users that do not require filtering
Everything needs to be AD-integrated

What does you all suggest?

Improve this question

4 Answers 4

Reset to default
2

One of my Customers has a very similiar topology, albeit with a couple fewer sites on the MPLS. We looked at Websense, but in the end they opted for Barracuda filtering devices at each site. The cost was a little less for the Barracuda devices for their situation, and they liked the user interface a bit more. If you haven't looked at them, you may want to. There's an argument to be made, since they're hardware devices, re: the TCO of the solution as compared to Websense running on traditional servers.

Unless you're into rolling your own, I'd say that Websense is probably your best bet. (I admin a Websense install at one Customer site, too. I offer you my condolences in advance for having to deal with their brain-damaged admin user interface and seemingly random need to have the server re-built frequently. What the application does is nice, but the underlying technology seems like glue and tape.)

Improve this answer
0
0

I've been very satisfied with a Squid+SquidGuard on CentOS implementation. It is a 'hands-on' solution, but not overly difficult to work with. You could always stack something like webmin on to give you web-based management. Setup winbind to work with Active Directory and you get seamless authentication. Use sarge to generate utilization reports. Squid has intelligent peering settings where the proxy at one site can check others to see if it already has the content (maybe not too valuable if each location has Internet).

Build your own, download a prebuilt appliance from vmware, lots of options.

One note is that you can not use authentication in squid if you want it to be 'transparent' - meaning you'll have to make sure each user has their browser proxy settings in there(AD Policy, etc)

Improve this answer
0

Would probably go for a filtering unit at each ingress/egress point, and then replicate any necessary policies out. 100 users is not so many in web filter terms - be carefull that whoever you buy of is "kind" with regard to "lots of little installs" - you don't want to get stung on s/w licencing as well as the extra hardware.

In Websense you have what is arguably one of the top products on the market - but it is also top for price. As another poster has mentioned you will find less expensive alternatives.

I am biased - I work for SmoothWall - but I would recommend you take a look at our site anyway if you are thinking about where you are going budget wise :) http://www.smoothwall.net

Improve this answer
-1

A simple an inexpensive solution is to use OpenDNS.

Improve this answer
1
  • Unless I'm mistaken, OpenDNS won't allow me to create different filtering per Active Directory user. Similarly, I'd really like to use our in-house DNS server.
    – Russ Warren
    Jun 17, 2009 at 17:15

Not the answer you're looking for? Browse other questions tagged .